Ubuntu: large syslog and kern.log files [closed]

This is an old question, but neither of the previous two answers are good solutions:

• The accepted answer doesn’t explain why the disk problem goes away if you fix the underlying system issue (the answer is logrotate), plus your system may keep writing to the logs and fill up your disk before you can even figure out the underlying issue.
• The other answer removes and disables the logs entirely, which is not a good approach as it ignores the underlying issue. Also, you’ll probably want those log files later when you’re figuring out other system problems — disabling syslog makes it more difficult to track down future issues!

Instead, here is a safer method that lets you keep the log files while reclaiming disk space while also stopping the log files from doing this again.

1. Safely clear the logs: after looking at (or backing up) the logs to identify your system’s problem, clear them by typing > /var/log/syslog (including the >). You may need to be root user for this, in which case enter sudo su, your password, and then the above command).

• Then restart the syslog service (either systemctl restart syslog or service syslog restart).

2. Then, you can force the logs to rotate and delete automatically if they reach a certain size, using logrotate. In this case you can edit the config with sudo nano /etc/logrotate.d/rsyslog and add one line:

/var/log/syslog
{
    rotate 7
    daily
    maxsize 1G # add this line
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

• This will force your syslog to “rotate” (i.e., create a new log file and archive the previous log file) after either 1 day or when the file becomes 1GB, whichever comes first. Note that rotate 7 means your system will only keep 7 total syslog backups so it can only ever take up 7GB of space
• Note: you can change maxsize, rotate N, and other settings to customize your logs — use the command man logrotate to see more.

3. While you’re at it, you may want to add the same setting in the second part of the file, which governs the behavior of other log files (e.g. kern.log for kernel events, auth.log for authentication events, etc.). This setting will make it so that each of these other log files will only take 4GB in total.:

...
{
    rotate 4
    weekly
    maxsize 1G
...
}

This will allow your system to keep logging events without them filling your disk.

For more, see the manual and a similar question.